docker-tag.yml

name: Build Tagged Release Image
# Fires only when a tag matching semver-with-v-prefix is pushed, e.g. v0.12.9
# (matches https://github.com/OWNER/REPO/tags style version tags).
# A push to main/staging does NOT trigger this — only an actual tag push does.
on:
  push:
    tags:
      - 'v*.*.*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

env:
  IMAGE_NAME: ghcr.io/${{ github.repository }}

jobs:
  prepare:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      tag_name: ${{ steps.latest.outputs.tag_name }}
      is_latest: ${{ steps.latest.outputs.is_latest }}
    steps:
      - name: Determine if this tag is the current latest release
        id: latest
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG_NAME="${{ github.ref_name }}"
          echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
          # GitHub's "latest release" API endpoint automatically excludes
          # drafts and pre-releases, so this is a more reliable check than
          # just pattern-matching the tag string for '-rc'/'-beta' etc.
          LATEST=$(gh api "repos/${{ github.repository }}/releases/latest" --jq .tag_name 2>/dev/null || echo "")
          if [ "$TAG_NAME" = "$LATEST" ]; then
            echo "is_latest=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_latest=false" >> "$GITHUB_OUTPUT"
          fi
          echo "Tag: $TAG_NAME | Latest published release: ${LATEST:-<none>} | is_latest=$( [ "$TAG_NAME" = "$LATEST" ] && echo true || echo false )"

  build:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runs-on: ubuntu-26.04
          - platform: linux/arm64
            runs-on: ubuntu-26.04-arm
    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: 45
    steps:
      - name: Checkout tag
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare platform tag
        id: platform
        run: |
          platform=${{ matrix.platform }}
          echo "pair=${platform//\//-}" >> "$GITHUB_OUTPUT"

      # Push each arch to the registry by digest only — no human-readable tag
      # yet. Digests get stitched into one multi-arch manifest by the merge
      # job below, which is what carries the real tags (v1.2.3, stable, etc).
      - name: Build and push (${{ matrix.platform }})
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=release-${{ steps.platform.outputs.pair }}
          cache-to: type=gha,mode=max,scope=release-${{ steps.platform.outputs.pair }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ steps.platform.outputs.pair }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    needs: [prepare, build]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build tags list
        id: tags
        run: |
          # One tag per line — build-push-action's `tags:` input requires
          # newline-separated entries, not space-separated.
          {
            echo "tags<<EOF"
            echo "${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.tag_name }}"
            if [ "${{ needs.prepare.outputs.is_latest }}" = "true" ]; then
              echo "${{ env.IMAGE_NAME }}:stable"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(echo "${{ steps.tags.outputs.tags }}" | sed 's/^/-t /' | tr '\n' ' ') \
            $(printf '${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.tag_name }}

      - name: Summary
        run: |
          echo "### Release image build" >> "$GITHUB_STEP_SUMMARY"
          echo "- Tag pushed: \`${{ needs.prepare.outputs.tag_name }}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- Also tagged 'stable': \`${{ needs.prepare.outputs.is_latest }}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- Platforms: linux/amd64, linux/arm64" >> "$GITHUB_STEP_SUMMARY"